Imagine you find a locked safe with a 20-digit combination, and for 25 years everyone assumes the combination was chosen by a genius cryptographer with hidden motives. Then someone realizes the combination is just the serial number stamped on the back of the safe, run through the cheapest lock mechanism in the catalog. That's what happened here. The NIST elliptic curve seeds — the mysterious constants underpinning one of the world's most widely deployed digital signature standards — were generated by calling lrand48(), a weak pseudorandom number generator that shipped with every 1990s C compiler, initialized with whatever the Unix clock read at the time. The committed claim: an Anthropic research model (Claude) recovered the exact provenance of 10 NIST/ANSI elliptic curve seeds plus 6 base points, resolving a decades-old open question in cryptography. Each seed is the output of lrand48() seeded by a Unix timestamp between May 1997 and April 1998, with the output bits taken as lrand48() >> 23. The 160-bit seeds can be regenerated exactly from a 32-bit timestamp plus a small iteration index. For P-256, the published seed is candidate 1842 from its run. This is not an incremental paper — it is a definitive forensic result that closes the question for all but one curve (B-163). The method is elegant cryptanalysis, not brute force. Claude noticed that the top bits of many seeds were all zero — a telltale signature of lrand48(), which returns only the upper 31 bits of its 48-bit internal state. The probability of that pattern appearing by chance across the seeds is roughly 1 in 5,810. From there, recovering the full internal state is a textbook lattice problem: the Lenstra–Lenstra–Lovász (LLL) algorithm reconstructs truncated linear congruential generator states from partial output. Claude ran the solver over every possible bit window, found consistent matches for all ten prime-curve seeds, then walked each state backward to its srand48 initialization — every one a plausible Unix timestamp. The base points for six curves were traced to FreeLIP's RNG seeded with small integers (20000, 20420, 20507, 20509, 20512, 20517). The integrity story is unusually strong for a discovery of this kind. The result is deterministically verifiable: anyone can take the claimed timestamps, run lrand48, and check that the output matches the published NIST seeds bit-for-bit. Ten seeds × 160 bits = 1,600 bits of match from a 32-bit input. There is no statistical ambiguity, no confidence interval, no p-value debate. The verification is a one-liner in C. The authors are transparent about what remains unexplained: the B-163 seed, the base points for P-224/P-256/P-384/P-521, and the criteria used to skip candidate seeds during generation. The prior baseline for this problem was zero — the best anyone had was Jerry Solinas's vague recollection of a humorous passphrase, which turned out to be wrong. Multiple researchers and an active bounty ($36,864) had failed to find the answer. The amateur investigation cataloged by Koblitz and Menezes in 'A Riddle Wrapped in an Enigma' laid out the concern but couldn't resolve it. Claude solved it in under 30 minutes by reasoning about the software environment rather than searching over passphrases — a fundamentally different approach that treated the problem as reverse engineering rather than password cracking. What this means practically is reassuring, not alarming. The simplicity and mundanity of the generation process — a clock-seeded weak PRNG, not a carefully constructed backdoor — makes it much harder to argue these curves were subverted. Some candidates were skipped during generation (P-256's seed is candidate 1842, but candidate 876 also yielded a valid curve), and the authors correctly note this leaves a small residual question. But the number of skipped candidates is small enough that searching over timestamps for a weakened curve would require disclosing the timestamp as evidence of innocence — a circular strategy. The $36,864 bounty will be donated to the Internet Security Research Group. The deeper story is about AI as a research tool. Claude didn't find this by exhaustive search or by following the human-generated clue (the passphrase rumor). It reasoned about what software a 1990s NSA engineer would have had available, identified a distinguishing signature of that software's output, and then applied classical cryptanalytic techniques (lattice reduction) to recover the state. The model's own chain of thought includes a moment of self-skepticism — wondering if it's in a simulated test environment — before confirming the match is real. This is a concrete example of an AI system solving an open research problem by combining domain knowledge with systematic search in a way that humans had not attempted.
